 (defmethod must-update? :bcrypt+sha512
   [{:keys [alg iterations]}]
   true)
+
+(defmethod must-update? :pbkdf2+sha256
+  [{:keys [password iterations alg]}]
+  (or (< (count password) 32)
+      (let [desired-iterations (get +iterations+ alg)]
+        (and desired-iterations (> desired-iterations iterations)))))
 
 (defmethod must-update? :scrypt
   [{:keys [alg memcost cpucost]}]

        candidate (bytes/concat salt attempt salt)]
    (scrypt/verify (codecs/bytes->hex candidate)
                   (codecs/bytes->str (:password pwdparams)))))

(defmethod check-password :default
  [pwdparams attempt]

  [options]
  (derive-password (assoc options :alg :pbkdf2 :digest :sha1)))

(defmethod derive-password :pbkdf2+sha256
  [options]
  (derive-password (assoc options :alg :pbkdf2 :digest :sha256)))

(defmethod derive-password :pbkdf2+sha512
  [options]
  (derive-password (assoc options :alg :pbkdf2 :digest :sha512)))

(defmethod derive-password :pbkdf2+blake2b-512
  [options]
